| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: WIN 7: Virusfunde Win32.Application.SubTab.A / Win32.Application.DownloadSponsor.DWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
09.05.2014, 11:22
| #1 |
 |  WIN 7: Virusfunde Win32.Application.SubTab.A / Win32.Application.DownloadSponsor.D Hallo verehrte Community, ich hab mir mal wieder was eingefangen und zwar folgendermaßen: Auf der Suche nach einem Tool zum Konvertieren von mp4 zu mp3-dateien kam ich auf die eigentlich unverdächtige Seite von GIGA und habe mir fre : ac runtergeladen. Bei der Installation hab ich alle Häckchen bei dem Adware-Schmarrn entfernt und dann installiert. Kurz darauf kam der Alarm von GData, im Browser (Firefox 28) öffnete sich dann eine Website (siehe Screenshot im Anhang), die sich automatisch als Startseite speichert. Ich hab sie zwar wieder auf die alte URL zurückgestellt, ändert aber nix, sobald ich den Browser starte, kommt die Seite wieder. Ich hoffe, dass ihr mir helfen könnt und bedanke mich schon mal ganz herzlich für die Zeit, die ihr an mein Problem verschwendet. Ansonsten an Alle: FINGER WEG VOM FRE:AC-DRECK! Hier der Alarmbericht GData: Code:
ATTFilter Beim Schließen der Datei "C:\Users\***\AppData\Local\Temp\9062800\9062800.zipDir\tmp\SupTab.exe" wurde der Virus "Win32.Application.SubTab.A" entdeckt. Zugriff verweigert.
Beim Schließen der Datei "C:\Users\***\AppData\Local\Temp\9062800\9062800.zipDir\tmp\SupTab.exe" wurde der Virus "Win32.Application.SubTab.A (Engine B)" entdeckt. Zugriff verweigert.
Beim Öffnen der Datei "C:\Users\***\AppData\Local\Temp\9062800\9062800.zipDir\tmp\SupTab.exe" wurde der Virus "Win32.Application.SubTab.A" entdeckt. Zugriff verweigert.
Beim Öffnen der Datei "C:\Users\***\AppData\Local\Temp\9062800\9062800.zipDir\tmp\SupTab.exe" wurde der Virus "Win32.Application.SubTab.A (Engine B)" entdeckt. Zugriff verweigert.
Code:
ATTFilter Virenprüfung mit G Data InternetSecurity
Version 25.0.1.2 (20.03.2014)
Virensignaturen vom 09.05.2014
Startzeit: 09.05.2014 10:20:27
Engine(s): Engine A (AVA 24.1975), Engine B (GD 25.3230)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein
Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 09.05.2014 10:42:56
124054 Dateien überprüft
2 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
Objekt: $RXR1FNM.exe
Pfad: C:\$Recycle.Bin\S-1-5-21-1575497497-273483109-2788137214-1000
Status: Datei in Quarantäne verschoben
Virus: Win32.Application.DownloadSponsor.D (Engine B)
Objekt: SupTab.exe
Pfad: C:\Users\Tomsk\AppData\Local\Temp\9062800\9062800.zipDir\tmp
Status: Datei in Quarantäne verschoben
Virus: Win32.Application.SubTab.A (Engine B)
Logfile von defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:21 on 09/05/2014 (***)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-05-2014 01
Ran by *** (administrator) on APPARAT on 09-05-2014 11:22:57
Running from C:\Users\***\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(UPEK Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Intel Corporation) C:\Program Files\Intel\AMT\atchksrv.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Lenovo) C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
(Intel Corporation) C:\Program Files\Intel\AMT\UNS.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
(Intel Corporation) C:\Program Files\Intel\AMT\atchk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo Group Limited) C:\Program Files\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\password_manager.exe
(Lenovo.) C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Lenovo) C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2270504 2011-05-19] (Synaptics Incorporated)
HKLM\...\Run: [cssauth] => C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [3110200 2011-12-13] (Lenovo Group Limited)
HKLM\...\Run: [PSQLLauncher] => C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe [55120 2010-12-08] (UPEK Inc.)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [13556256 2008-11-15] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] => C:\Windows\system32\NvMcTray.dll [92704 2008-11-15] (NVIDIA Corporation)
HKLM\...\Run: [PWMTRV] => C:\Program Files\ThinkPad\Utilities\PWMTR32V.DLL [4395104 2012-05-16] (Lenovo Group Limited)
HKLM\...\Run: [atchk] => C:\Program Files\Intel\AMT\atchk.exe [401408 2009-11-30] (Intel Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-07] (Intel Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TpShocks] => C:\Windows\system32\\TpShocks.exe [337256 2011-03-29] (Lenovo.)
HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
HKU\S-1-5-21-1575497497-273483109-2788137214-1000\...\Policies\Explorer: []
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: IePasswordManagerHelper Class - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\\mscoree.dll (Microsoft Corporation)
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\\mscoree.dll (Microsoft Corporation)
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\system32\\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: sweet-page
FF SelectedSearchEngine: sweet-page
FF Homepage: www.bing.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Quick Start - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\quick_start@gmail.com [2014-05-09]
FF Extension: Flashblock - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-11-21]
FF Extension: WOT - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-28]
FF Extension: DownloadHelper - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25]
FF Extension: Ghostery - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\firefox@ghostery.com.xpi [2013-11-21]
FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-21]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-12-10]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-01-21]
FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\extensions\quick_start@gmail.com
FF Extension: Quick Start - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\7aw1kt3n.default\extensions\quick_start@gmail.com [2014-05-09]
FF HKCU\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension\2.0b12
FF Extension: ThinkVantage Password Manager - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension\2.0b12 [2012-08-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-12-10]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.sweet-page.com/?type=sc&ts=1399622915&from=wld&uid=HITACHIXHTS542580K9SA00_080723BB6B02WFHZ6WWGX
========================== Services (Whitelisted) =================
S4 Adobe Version Cue CS2; c:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated)
R2 atchksrv; C:\Program Files\Intel\AMT\atchksrv.exe [176128 2009-11-30] (Intel Corporation)
R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1064752 2014-02-24] (Flexera Software LLC)
R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [45496 2011-04-04] (Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S4 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
S3 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited)
S3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567256 2012-11-25] (Mister Group)
R2 TPHKLOAD; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [130920 2011-04-20] (Lenovo Group Limited)
R2 TSSCoreService; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [988472 2011-12-13] (Lenovo)
R2 UNS; C:\Program Files\Intel\AMT\UNS.exe [1458176 2009-11-30] (Intel Corporation)
S3 WinHttpAutoProxySvc; C:\Windows\system32\\winhttp.dll [351232 2010-11-20] (Microsoft Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [540304 2014-04-30] (Cherished Technololgy LIMITED)
==================== Drivers (Whitelisted) ====================
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2014-04-16] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20736 2014-04-16] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2014-04-16] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2014-04-16] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2014-04-16] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2014-04-28] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2014-04-16] (G Data Software AG)
R3 NETwLv32; C:\Windows\System32\DRIVERS\NETwLv32.sys [6639616 2010-10-07] (Intel Corporation)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [12560 2009-03-13] (UPEK Inc.)
S3 swmx01; C:\Windows\system32\drivers\swmx01.sys [72576 2007-04-10] (Sierra Wireless Inc.)
S3 SWUMX01; C:\Windows\system32\drivers\swumx01.sys [70656 2007-01-12] (Sierra Wireless Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-09 11:22 - 2014-05-09 11:22 - 00017623 _____ () C:\Users\***\Desktop\FRST.txt
2014-05-09 11:21 - 2014-05-09 11:22 - 00000472 _____ () C:\Users\***\Desktop\defogger_disable.log
2014-05-09 11:07 - 2014-05-09 11:07 - 00380416 _____ () C:\Users\***\Downloads\Gmer-19357.exe
2014-05-09 11:06 - 2014-05-09 11:06 - 01053184 _____ (Farbar) C:\Users\***\Desktop\FRST.exe
2014-05-09 11:05 - 2014-05-09 11:05 - 00050477 _____ () C:\Users\***\Desktop\Defogger.exe
2014-05-09 10:10 - 2014-05-09 10:10 - 00000000 ____D () C:\ProgramData\WPM
2014-05-09 10:09 - 2014-05-09 10:09 - 00000928 _____ () C:\Users\Public\Desktop\freac - free audio converter.lnk
2014-05-09 10:09 - 2014-05-09 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\freac - free audio converter
2014-05-09 10:08 - 2014-05-09 10:09 - 00000000 ____D () C:\Program Files\freac
2014-05-09 10:05 - 2014-05-09 10:05 - 01062288 _____ () C:\Users\***\Downloads\fre_ac-audio-converter-lnstall.exe
2014-05-09 09:58 - 2014-05-09 09:58 - 00466744 _____ () C:\Users\***\Downloads\download_audiograbber.exe
2014-05-08 06:39 - 2014-05-09 11:21 - 00000000 ____D () C:\Users\***\AppData\Roaming\Audacity
2014-05-08 06:39 - 2014-05-08 06:39 - 00000984 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2014-05-08 06:39 - 2014-05-08 06:39 - 00000972 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-05-08 06:39 - 2014-05-08 06:39 - 00000000 ____D () C:\Program Files\Audacity
2014-05-07 06:37 - 2014-05-07 06:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 18:19 - 2014-04-14 04:11 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 18:19 - 2014-04-14 04:07 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-05 06:59 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-30 22:23 - 2014-05-01 19:07 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-04-29 20:51 - 2014-04-29 20:51 - 00002212 _____ () C:\Users\Public\Desktop\DWG TrueView 2015 - English.lnk
2014-04-29 20:51 - 2014-04-29 20:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2014-04-29 20:49 - 2014-04-29 20:49 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
2014-04-29 20:46 - 2014-04-29 20:46 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-29 18:29 - 2014-04-29 18:29 - 01640590 _____ () C:\Users\***\Downloads\764_Housing
2014-04-29 18:29 - 2014-04-29 18:29 - 00072671 _____ () C:\Users\***\Downloads\909_Swimming
2014-04-29 18:29 - 2014-04-29 18:29 - 00042012 _____ () C:\Users\***\Downloads\774_Plantation
2014-04-29 18:07 - 2014-04-29 18:07 - 01150828 _____ () C:\Users\***\Downloads\82_People_Swimmers
2014-04-29 18:04 - 2014-04-29 18:04 - 00743480 _____ () C:\Users\***\Downloads\438_Volleyball
2014-04-29 16:53 - 2014-04-29 16:53 - 00000000 ____D () C:\Users\Default\Downloads\medialink
2014-04-29 16:53 - 2014-04-29 16:53 - 00000000 ____D () C:\Users\Default User\Downloads\medialink
2014-04-29 16:52 - 2014-04-29 16:58 - 46002830 _____ () C:\Users\Default\Downloads\39589.mp4
2014-04-29 16:52 - 2014-04-29 16:58 - 46002830 _____ () C:\Users\Default User\Downloads\39589.mp4
2014-04-29 09:00 - 2014-04-29 20:48 - 00000000 ____D () C:\Program Files\Autodesk
2014-04-29 06:52 - 2014-04-29 06:52 - 00921512 _____ (Oracle Corporation) C:\Users\***\Downloads\jxpiinstall.exe
2014-04-24 19:36 - 2014-04-24 19:36 - 00000000 ____D () C:\Users\***\Documents\AdobeStockPhotos
2014-04-21 23:10 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-21 23:10 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-21 23:10 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-21 23:10 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-21 23:10 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-21 23:10 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-21 23:10 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-21 23:10 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-21 23:10 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-21 23:10 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-21 23:10 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-21 23:10 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-21 23:10 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-21 23:10 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-21 23:10 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-21 23:10 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-21 23:10 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-21 23:10 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-21 23:10 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-21 23:10 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-21 23:10 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-21 23:10 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-21 23:10 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-21 23:10 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-21 19:02 - 2014-04-21 19:02 - 01908225 _____ () C:\Users\***\Downloads\VirtualDub-1.10.4.zip
2014-04-21 19:00 - 2014-04-21 19:07 - 79086728 _____ (Lightworks) C:\Users\***\Downloads\lightworks_v11.5.1_full_32bit.exe
2014-04-17 13:46 - 2014-04-17 13:54 - 24145786 _____ () C:\Users\Default\Downloads\976546.flv
2014-04-17 13:46 - 2014-04-17 13:54 - 24145786 _____ () C:\Users\Default User\Downloads\976546.flv
2014-04-17 12:34 - 2014-04-17 12:57 - 98418176 _____ () C:\Users\Default\Downloads\2833384.flv
2014-04-17 12:34 - 2014-04-17 12:57 - 98418176 _____ () C:\Users\Default User\Downloads\2833384.flv
2014-04-16 10:10 - 2014-04-16 10:10 - 00020736 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys
2014-04-16 10:10 - 2014-04-16 10:10 - 00001943 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-16 10:10 - 2014-04-16 10:10 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt32_01007.Wdf
2014-04-16 10:10 - 2014-04-16 10:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-10 12:57 - 2014-04-10 13:25 - 111863875 _____ () C:\Users\Default\Downloads\2155873_hd.flv
2014-04-10 12:57 - 2014-04-10 13:25 - 111863875 _____ () C:\Users\Default User\Downloads\2155873_hd.flv
2014-04-10 07:05 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 07:05 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 07:05 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 07:05 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 07:05 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 07:05 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
==================== One Month Modified Files and Folders =======
2014-05-09 11:23 - 2014-05-09 11:22 - 00017623 _____ () C:\Users\***\Desktop\FRST.txt
2014-05-09 11:22 - 2014-05-09 11:21 - 00000472 _____ () C:\Users\***\Desktop\defogger_disable.log
2014-05-09 11:22 - 2013-11-27 17:21 - 00000000 ____D () C:\FRST
2014-05-09 11:21 - 2014-05-08 06:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Audacity
2014-05-09 11:10 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-09 11:08 - 2014-01-05 13:37 - 00000000 ____D () C:\Users\***\AppData\Local\FreePDF_XP
2014-05-09 11:07 - 2014-05-09 11:07 - 00380416 _____ () C:\Users\***\Downloads\Gmer-19357.exe
2014-05-09 11:06 - 2014-05-09 11:06 - 01053184 _____ (Farbar) C:\Users\***\Desktop\FRST.exe
2014-05-09 11:05 - 2014-05-09 11:05 - 00050477 _____ () C:\Users\***\Desktop\Defogger.exe
2014-05-09 10:55 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-09 10:55 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-09 10:10 - 2014-05-09 10:10 - 00000000 ____D () C:\ProgramData\WPM
2014-05-09 10:09 - 2014-05-09 10:09 - 00000928 _____ () C:\Users\Public\Desktop\freac - free audio converter.lnk
2014-05-09 10:09 - 2014-05-09 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\freac - free audio converter
2014-05-09 10:09 - 2014-05-09 10:08 - 00000000 ____D () C:\Program Files\freac
2014-05-09 10:08 - 2013-11-21 23:39 - 00001340 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-09 10:08 - 2013-11-21 18:24 - 00001632 _____ () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-09 10:05 - 2014-05-09 10:05 - 01062288 _____ () C:\Users\***\Downloads\fre_ac-audio-converter-lnstall.exe
2014-05-09 09:59 - 2013-11-21 17:59 - 02035615 _____ () C:\Windows\WindowsUpdate.log
2014-05-09 09:58 - 2014-05-09 09:58 - 00466744 _____ () C:\Users\***\Downloads\download_audiograbber.exe
2014-05-09 09:52 - 2013-11-22 21:09 - 00000000 ____D () C:\Users\***\dwhelper
2014-05-09 09:41 - 2014-01-09 11:46 - 00000000 ____D () C:\Users\***\Documents\11_MISC
2014-05-09 07:37 - 2014-03-02 02:00 - 00007371 _____ () C:\Windows\setupact.log
2014-05-09 07:37 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-08 06:39 - 2014-05-08 06:39 - 00000984 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2014-05-08 06:39 - 2014-05-08 06:39 - 00000972 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-05-08 06:39 - 2014-05-08 06:39 - 00000000 ____D () C:\Program Files\Audacity
2014-05-07 06:37 - 2014-05-07 06:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 07:43 - 2013-11-21 23:45 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc
2014-05-02 11:20 - 2013-12-10 14:16 - 00000000 ____D () C:\Users\***\Documents\9_HAUS
2014-05-02 11:12 - 2013-11-21 23:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-01 19:07 - 2014-04-30 22:23 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-05-01 18:37 - 2012-08-24 13:23 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-01 18:37 - 2012-08-24 13:23 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-04-30 09:53 - 2009-07-14 06:33 - 00376032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-29 20:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-04-29 20:52 - 2013-11-21 18:13 - 00097968 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-29 20:51 - 2014-04-29 20:51 - 00002212 _____ () C:\Users\Public\Desktop\DWG TrueView 2015 - English.lnk
2014-04-29 20:51 - 2014-04-29 20:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2014-04-29 20:51 - 2014-03-30 16:08 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-04-29 20:51 - 2014-03-30 16:07 - 00000000 ____D () C:\Users\***\AppData\Roaming\Autodesk
2014-04-29 20:50 - 2014-03-30 16:07 - 00000000 ____D () C:\ProgramData\Autodesk
2014-04-29 20:49 - 2014-04-29 20:49 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
2014-04-29 20:48 - 2014-04-29 09:00 - 00000000 ____D () C:\Program Files\Autodesk
2014-04-29 20:48 - 2014-03-30 16:11 - 00000000 ____D () C:\Users\***\AppData\Local\Autodesk
2014-04-29 20:46 - 2014-04-29 20:46 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-29 18:29 - 2014-04-29 18:29 - 01640590 _____ () C:\Users\***\Downloads\764_Housing
2014-04-29 18:29 - 2014-04-29 18:29 - 00072671 _____ () C:\Users\***\Downloads\909_Swimming
2014-04-29 18:29 - 2014-04-29 18:29 - 00042012 _____ () C:\Users\***\Downloads\774_Plantation
2014-04-29 18:07 - 2014-04-29 18:07 - 01150828 _____ () C:\Users\***\Downloads\82_People_Swimmers
2014-04-29 18:04 - 2014-04-29 18:04 - 00743480 _____ () C:\Users\***\Downloads\438_Volleyball
2014-04-29 16:58 - 2014-04-29 16:52 - 46002830 _____ () C:\Users\Default\Downloads\39589.mp4
2014-04-29 16:58 - 2014-04-29 16:52 - 46002830 _____ () C:\Users\Default User\Downloads\39589.mp4
2014-04-29 16:53 - 2014-04-29 16:53 - 00000000 ____D () C:\Users\Default\Downloads\medialink
2014-04-29 16:53 - 2014-04-29 16:53 - 00000000 ____D () C:\Users\Default User\Downloads\medialink
2014-04-29 14:48 - 2014-05-05 06:59 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 14:34 - 2014-05-05 06:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 06:52 - 2014-04-29 06:52 - 00921512 _____ (Oracle Corporation) C:\Users\***\Downloads\jxpiinstall.exe
2014-04-28 14:39 - 2013-11-23 04:45 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-04-28 14:39 - 2013-11-23 04:45 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-04-25 19:37 - 2013-11-21 22:07 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe
2014-04-24 20:23 - 2009-07-14 04:04 - 00000438 _____ () C:\Windows\win.ini
2014-04-24 19:36 - 2014-04-24 19:36 - 00000000 ____D () C:\Users\***\Documents\AdobeStockPhotos
2014-04-24 19:36 - 2012-08-24 13:23 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-22 19:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-22 08:10 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-21 19:07 - 2014-04-21 19:00 - 79086728 _____ (Lightworks) C:\Users\***\Downloads\lightworks_v11.5.1_full_32bit.exe
2014-04-21 19:02 - 2014-04-21 19:02 - 01908225 _____ () C:\Users\***\Downloads\VirtualDub-1.10.4.zip
2014-04-18 12:11 - 2013-11-29 16:33 - 00000000 ____D () C:\ProgramData\ORCA AVA
2014-04-17 13:54 - 2014-04-17 13:46 - 24145786 _____ () C:\Users\Default\Downloads\976546.flv
2014-04-17 13:54 - 2014-04-17 13:46 - 24145786 _____ () C:\Users\Default User\Downloads\976546.flv
2014-04-17 12:57 - 2014-04-17 12:34 - 98418176 _____ () C:\Users\Default\Downloads\2833384.flv
2014-04-17 12:57 - 2014-04-17 12:34 - 98418176 _____ () C:\Users\Default User\Downloads\2833384.flv
2014-04-16 18:48 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-16 10:10 - 2014-04-16 10:10 - 00020736 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys
2014-04-16 10:10 - 2014-04-16 10:10 - 00001943 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-16 10:10 - 2014-04-16 10:10 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt32_01007.Wdf
2014-04-16 10:10 - 2014-04-16 10:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-16 10:10 - 2013-11-21 18:21 - 00056832 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-04-16 10:10 - 2013-11-21 18:21 - 00050176 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-04-16 10:09 - 2013-11-21 18:21 - 00101504 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-04-16 10:09 - 2013-11-21 18:21 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys
2014-04-16 10:09 - 2013-11-21 18:21 - 00044544 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-04-16 10:08 - 2013-11-21 18:19 - 00000000 ____D () C:\ProgramData\G Data
2014-04-16 10:08 - 2013-11-21 18:19 - 00000000 ____D () C:\Program Files\Common Files\G Data
2014-04-16 10:08 - 2012-08-24 14:45 - 00022158 _____ () C:\Windows\DPINST.LOG
2014-04-14 04:11 - 2014-05-06 18:19 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:07 - 2014-05-06 18:19 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-10 13:25 - 2014-04-10 12:57 - 111863875 _____ () C:\Users\Default\Downloads\2155873_hd.flv
2014-04-10 13:25 - 2014-04-10 12:57 - 111863875 _____ () C:\Users\Default User\Downloads\2155873_hd.flv
2014-04-10 11:25 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 11:19 - 2013-11-25 08:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 11:17 - 2013-11-25 08:33 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 07:00 - 2013-11-22 21:03 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe
Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\AcDeltree.exe
C:\Users\***\AppData\Local\Temp\DATAflor.UpdateManager.exe
C:\Users\***\AppData\Local\Temp\FNP_ACT_InstallerCA.dll
C:\Users\***\AppData\Local\Temp\freac-1.0.21a.exe
C:\Users\***\AppData\Local\Temp\sdanircmdc.exe
C:\Users\***\AppData\Local\Temp\sdapskill.exe
C:\Users\***\AppData\Local\Temp\sdaspwn.exe
C:\Users\***\AppData\Local\Temp\sweetpage294wld_n2.exe
C:\Users\***\AppData\Local\Temp\vlc-2.1.3-win32.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-29 20:01
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-09 11:55:00
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 HITACHI_ rev.BBBZ 74,53GB
Running: Gmer-19357.exe; Driver: C:\Users\***\AppData\Local\Temp\kwddrpow.sys
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 82C859A5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 82CA5512 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Tppwr32v.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Tppwr32v.sys
Device \Driver\SynTP \Device\00000072 Tppwr32v.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002268ef072f
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002268ef072f (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{6926CC11-52C5-11E3-9DE7-806E6F6E6963} 2365984768
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1
---- EOF - GMER 2.1 ----
|
| Themen zu WIN 7: Virusfunde Win32.Application.SubTab.A / Win32.Application.DownloadSponsor.D |
| administrator, browser, converter, festplatte, homepage, iexplore.exe, infizierte, installation, newtab, problem, prozesse, pup.optional.skytech.a, pup.optional.wpmanager, services.exe, sich automatisch, sierra, software, svchost.exe, sweet-page, sweet-page entfernen, sweetpage, sweetpage entfernen, windows, winlogon.exe |
Baum-Darstellung